Skip to content
OpenAdvisories
Medium ALAS2023-2026-1539 2 CVEs

Moderate: vim security update (Amazon Linux 2023)

Published Apr 13, 2026 · Updated Apr 13, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-28422: Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue. CVE-2026-28421: Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a swap file. Version 9.2.0077 fixes the issue.

Fixed packages 12

ReleasePackageFixed in
Amazon Linux · 2023 vim-common 2:9.2.240-1.amzn2023.0.1
Amazon Linux · 2023 vim-data 2:9.2.240-1.amzn2023.0.1
Amazon Linux · 2023 vim-debuginfo 2:9.2.240-1.amzn2023.0.1
Amazon Linux · 2023 vim-debugsource 2:9.2.240-1.amzn2023.0.1
Amazon Linux · 2023 vim-default-editor 2:9.2.240-1.amzn2023.0.1
Amazon Linux · 2023 vim-enhanced 2:9.2.240-1.amzn2023.0.1
Amazon Linux · 2023 vim-enhanced-debuginfo 2:9.2.240-1.amzn2023.0.1
Amazon Linux · 2023 vim-filesystem 2:9.2.240-1.amzn2023.0.1
Amazon Linux · 2023 vim-minimal 2:9.2.240-1.amzn2023.0.1
Amazon Linux · 2023 vim-minimal-debuginfo 2:9.2.240-1.amzn2023.0.1
Amazon Linux · 2023 xxd 2:9.2.240-1.amzn2023.0.1
Amazon Linux · 2023 xxd-debuginfo 2:9.2.240-1.amzn2023.0.1

Vulnerabilities 2

  • Medium 5.3
    CVE-2026-28421

    Vim has a heap-buffer-overflow and a segmentation fault

    Vim is an open source, command line text editor. Versions prior to 9.2.0077 have a heap-buffer-overflow and a segmentation fault (SEGV) exist in Vim's swap file recovery logic. Both are caused by unvalidated fields read from crafted pointer blocks within a sw…

    vim vim vim vim Debian Ubuntu Azure Linux Alpine
  • Low 2.2
    CVE-2026-28422

    Vim has stack-buffer-overflow in build_stl_str_hl()

    Vim is an open source, command line text editor. Prior to version 9.2.0078, a stack-buffer-overflow occurs in `build_stl_str_hl()` when rendering a statusline with a multi-byte fill character on a very wide terminal. Version 9.2.0078 patches the issue.

    vim vim vim vim Debian Ubuntu Azure Linux Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-28421.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-28422.html